DNSimple DDOS Attack

Re:DNSimple DDOS Attack by kjttm on Monday December 01, 2014 @05:59PM (#8684589)

Does anyone have a simple explanation or link to an article / blog that explains the naked domain / ALIAS "problem" that DNSSimple solves? I recently set up DNS with DNSimple (due to nudging by Heroku) and am affected by this DDoS. I am still struggling to understand the exact nature of this issue. All of Heroku's documentation is pretty cryptic (to me):

"Some DNS hosts provide a way to get CNAME-like functionality at the zone apex using a custom record type. " .. and then on to suggest DNSimple as their first suggestion.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by beevek on Monday December 01, 2014 @06:06PM (#8684621)

http://blog.cloudflare.com/introducing-cname-flattening-rfc-... is a reasonable explanation. fundamentally a CNAME says "when you get queries for this name, go look at this other name instead". among other things, doing a CNAME at the zone apex means resolvers can't then find your NS, MX, or other records at the apex, which is problematic.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by callmeed on Monday December 01, 2014 @06:09PM (#8684650)

Basically, naked/apex domains generally require an A RECORD pointing to an IP address.

Heroku prefers you didn't use A RECORDS at all because the IP addresses in their underlying architecture might change. [1]

[1] https://devcenter.heroku.com/articles/apex-domains

[ Parent | on HN ]